How I Created ch4ll3ng3_01 — Fr3quency of L13s

A Builder’s Write-Up on Designing a Repeating-Key XOR CTF Challenge

By 4nn4_w1ls0n

Introduction

Whenever I build CTF challenges, I try to avoid making them feel like just another puzzle with random text and a hidden flag. I like challenges that tell a story, create curiosity, and make the player feel like they’re stepping into a situation rather than solving a worksheet.

That mindset is what led me to create:

ch4ll3ng3_03 — Fr3quency of L13s

ch4ll3ng3_03 — Fr3quency of L13s

This was a crypto challenge based on a fictional underground hacker collective named L1ES — a group known for intercepting communications, spreading deception, and disappearing before anyone can track them.

The player’s job was simple on paper:

Recover an intercepted encrypted transmission and find the hidden flag.

But behind that simple idea was one of the most classic beginner cryptography concepts:

Repeating-Key XOR — The Story Behind the Challenge

Instead of directly saying “Here is ciphertext, decrypt it,” I wanted the challenge to feel more immersive.

So I introduced the challenge like this:

The collective never sleeps. Every signal is a lie. An underground hacker collective called L1ES has been intercepting government communications for months. A junior analyst managed to capture one encrypted transmission before the channel went dark. The encryption looks deceptively simple — but nobody has cracked it yet.

That narrative served two purposes:

• It made the challenge more interesting
• It subtly hinted that deception and patterns would matter

What Players Received

The participants were given this ciphertext:

185920733c015f1a56112b1a1a566c5f20253a1c13055f173a031f1d6c7433362d1713055a1531120013254265327f025a131d521c0a0e563e48243e36154b19412d32471f40785237600005000f6c112d470f587f5538

And the following information:

• The encryption used repeating-key XOR
• The key was printable ASCII
• The plaintext was an English sentence
• It contained a flag in this format:

Cyberyami{…}

Why I Chose Repeating-Key XOR

Repeating-key XOR is one of the best choices for beginner-friendly crypto challenges.

It’s simple enough to understand, but not always instantly solvable for someone new.

To solve it, players need to think about:

• How XOR works
• How keys repeat across data
• Why English text creates patterns
• How automation helps in cryptography

That makes it a great learning challenge.

The Hidden Key

I wanted the key itself to feel connected to the storyline, so I used:

L1ES_n3v3r_sl3

This key was based on the challenge lore.

• L1ES = the hacker collective
• n3v3r = never
• sl3 = partial leetspeak version of sleep / sleeps

It also matched the challenge title and tone.

The Real Plaintext

The encrypted message was:

The collective never sleeps. Every signal is a lie. Cyberyami{xor_m4ss4cr3_k3y_cr4ck3d}

I intentionally wrote normal English text before the flag because readable sentences make XOR challenges fairer.

If the plaintext were random characters, solving would become frustrating instead of educational.

How I Encrypted It

I used a short Python script.

plaintext = b"The collective never sleeps. Every signal is a lie. Cyberyami{xor_m4ss4cr3_k3y_cr4ck3d}"
key = b"L1ES_n3v3r_sl3"

cipher = bytes([plaintext[i] ^ key[i % len(key)] for i in range(len(plaintext))])

print(cipher.hex())

The script loops through each byte of the plaintext and XORs it with the corresponding key byte. Once the key ends, it repeats from the beginning.

That output became the ciphertext used in the challenge.

How I Expected Players to Solve It

I didn’t want this to be a guessing challenge. I wanted it to reward logic.

A good solve path would look like this:

Step 1: Recognize It Isn’t Random

The ciphertext looks chaotic, but not truly random.

That usually suggests XOR, substitution, or structured encoding.

Step 2: Notice the Hint

The challenge explicitly mentions repeating-key XOR.

That narrows the approach immediately.

Step 3: Use English Patterns

Since the plaintext is English, spaces and common letters become valuable clues.

Step 4: Recover the Key

Eventually the repeating key becomes visible:

L1ES_n3v3r_sl3

Step 5: Decrypt and Extract the Flag

Example Solve Script

cipher_hex = "185920733c015f1a56112b1a1a566c5f20253a1c13055f173a031f1d6c7433362d1713055a1531120013254265327f025a131d521c0a0e563e48243e36154b19412d32471f40785237600005000f6c112d470f587f5538"

cipher = bytes.fromhex(cipher_hex)
key = b"L1ES_n3v3r_sl3"

plain = bytes([cipher[i] ^ key[i % len(key)] for i in range(len(cipher))])

print(plain.decode())

Output

The collective never sleeps. Every signal is a lie. Cyberyami{xor_m4ss4cr3_k3y_cr4ck3d}

Final Flag

Cyberyami{xor_m4ss4cr3_k3y_cr4ck3d}

What I Wanted Players to Learn

This challenge was not about making people suffer.

It was about teaching useful fundamentals through gameplay.

Players practicing this challenge would improve in:

• Working with hexadecimal data
• Understanding XOR logic
• Writing small Python scripts
• Thinking about repeating patterns
• Using hints effectively

Why I Named It “Fr3quency of L13s”

The title was chosen carefully.

It hints at:

• Frequency analysis
• Lies and deception
• The L1ES collective
• Leetspeak hacker culture

Even the title was meant to feel like part of the puzzle.

My Builder Philosophy

When I create CTF challenges, I try to follow one rule:

A challenge should be hard because it requires thinking — not because it is unfair.

There’s a big difference.

Players should feel satisfied after solving, not irritated.

That’s why I prefer realistic stories, clean logic, and clues hidden in plain sight.

Closing Thoughts

ch4ll3ng3_03 — Fr3quency of L13s was one of those challenges where a simple cryptographic technique became much more fun because of presentation.

Sometimes the best CTF ideas are not built from complexity.

They’re built from simplicity + atmosphere + good design.

And that combination often creates the most memorable challenges.

Author

4nn4_w1ls0n CTF Builder | Cybersecurity Researcher | Offensive Security Professional

CyberSecurity #CTF #Cryptography #XOR #Python #Writeup #CTFChallenge #EthicalHacking